Programmable Device Personalization

ABSTRACT

A semiconductor device may include a secure memory configured to store a programmable key, an interface for programming the programmable key in the secure memory, and a plurality of configurable features of the semiconductor device that are associated with the programmable key, each configurable feature having a set of multiple selectable configurations, wherein a value of the key defines a selection of one of the multiple configurations for each of the configurable features. For example, the key may include multiple sub-keys, each associated with one of the configurable features, wherein a value of each sub-key defines a selection of one of the multiple configurations for the configurable feature associated with that sub-key. In addition, the full programmable key may enable an additional functionality of the semiconductor device.

TECHNICAL FIELD

This application claims the benefit of U.S. Provisional Application No.61/780,994 filed on Mar. 14, 2013, which is incorporated herein in itsentirety.

The present disclosure relates to a programmable device personalization,in particular for semiconductor devices.

BACKGROUND

One security concern of customers today is protection againstreplication of a product. For example, in an automotive key fob, part ofthe security of the system relies on the fact that the actualapplication specific integrated circuit (ASIC) or system on a chip (SoC)is unique for the customer. This means a semiconductor manufacturer mustproduce a new mask set with some different underlying characteristics(memory map, pinout, functions, etc.) than that of the correspondinggeneral purpose device mask set.

SUMMARY

According to various embodiments, a programmable device personalizationcan be provided which provides for a scheme to allow end customers tocreate unique devices from general purpose products.

For example, one embodiment provides a semiconductor device may includea secure memory configured to store a programmable key, also referred toherein as a “device personalization key,” an interface for programmingthe programmable key in the secure memory, and a plurality ofconfigurable features of the semiconductor device that are associatedwith the programmable key, each configurable feature having a set ofmultiple selectable configurations, wherein a value of the key defines aselection of one of the multiple configurations for each of theconfigurable features. For example, the key may include multiplesub-keys, each associated with one of the configurable features, whereina value of each sub-key defines a selection of one of the multipleconfigurations for the configurable feature associated with thatsub-key. In addition, the full programmable key may enable an additionalfunctionality of the semiconductor device.

Another embodiment provides a method for configuring a semiconductordevice having an accessible memory, a secure memory, a configurationinterface, and a plurality of configurable features, each configurablefeature having a set of multiple selectable configurations. The methodmay include programming a key into the secure memory using theconfiguration interface provided on the semiconductor device, wherein avalue of the key defines a selection of one of the multipleconfigurations for each of the configurable features.

Thus, according to various embodiments, a programmable “devicepersonalization key” can be built into a general purpose device. In asituation in which a semiconductor device manufacturer supplies devicesto multiple customers, each customer can have a unique device based onthe device personalization key programmed into the respective device,either by the manufacturer, by the customer itself, or by another party.As mentioned above, each programmable key may include multiple sub-keys(each sub-key comprising a sub-set of bits of the full key), with eachsub-key being used to configure a particular aspect or feature of thedevice, such as a memory map for a device memory, a test entry code, anidentify or availability of a peripheral set, a pinout configuration, aninterrupt vector table location, program address scrambling/mappingconfigurations, etc. Each configurable feature of the device may havemultiple different possible configurations, and value of each sub-keymay define the selection of a particular one of the multiple possibleconfigurations for the configurable feature associated with thatconfigurable feature.

In some embodiments, the decoding of these sub-keys may be designed suchthat multiple values of each sub-key (or at least some sub-keys) willresult in the feature selection. For example, for the test entry codesub-key, values 1, 3, 7 may result in test entry code ‘A’, while values2, 5 result in test entry code ‘B’, and values 4, 6 result in test entrycode ‘C’. This increases the difficultly to reverse engineer a devicepersonalization key in the event that the feature set of the device(i.e., the selected configurations for the various configurablefeatures) can itself be reverse engineered. For example, with referenceto the example above, knowledge that a particular device is using testentry code ‘A’ instead of ‘B’ or ‘C’ does not indicate the exact testentry code sub-key value of the device personalization key, but ratheronly the possible set of sub-keys values on the device corresponding tothat test entry code (e.g., knowledge that the device is using testentry code ‘A’ indicates only that the entry code sub-key value is 1, 3,or 7. A particular advantage of this scheme, for further deterringcopying or reverse engineering of a device, is understood in view of theadditional device feature enabled by the full device personalizationkey, as discussed below.

In some embodiments, the full device personalization key can be used tocompute an additional value, or “sub-key,” that can be used to configureor personalize an additional feature, such as program addressscrambling/mapping, for example. In some embodiments, an existing CRCperipheral or a hash function could be used to generate a code numberfrom a long device personalization key. Thus, for a particular device,even if one were to determine a suitable sub-key to correctly configureeach sub-feature of the device, the additional feature enabled by thefull device personalization key cannot be provided without exactknowledge of the full device personalization key.

In some embodiments, the device is designed to allow the key to beprogrammed by either the manufacturer or by the customer itself.Allowing the customer to program its own key provides the additionalbenefit of placing the entire supply chain in the hands of the customerthemselves. That is, it becomes impossible for the manufacturer to sella first customer's “custom” device to a second customer, as themanufacturer does not know the device personalization key used by thefirst customer. Alternatively, programming the key by the manufacturerallows the manufacturer to provide personalized devices without havingto form multiple masks per product, as in conventional personalizationschemes. In other words, personalization can be done after the device ispackaged.

In some embodiments, according to the inventive features discussedabove, in order to clone a product, one must possess the originalprogram code (or image), the knowledge of which general purpose part isbeing used, and the exact and full device personalization key.

Thus, a device and method are available according to various embodimentsthat provide device personalization services to a broader customer basefor a lower cost.

BRIEF DESCRIPTION OF THE FIGURES

Example embodiments are discussed below with reference to the drawings,in which:

FIG. 1 shows a block diagram of an example semiconductor device, e.g.,microcontroller, which can be personalized using a devicepersonalization key, according to various embodiments;

FIG. 2 shows an example n-bit programmable key, having multiplesub-keys, that can be programmed into the device of FIG. 1, according toan example embodiment;

FIG. 3 illustrates the concept of assigning multiple sub-key values toeach selectable configuration for a particular configurable feature; and

FIG. 4 illustrates the generation of a “signature” value from theprogrammable key, which may be used to enable or configure anotherfeature of the personalized device.

DETAILED DESCRIPTION

FIG. 1 shows a block diagram of an example semiconductor device 10,e.g., microcontroller, which can be personalized according to variousfeatures of the present disclosure. Device 10 may include a processor12, a data memory 14, a program memory 16 storing one or more programs17 for providing various functionality of device 10, an optionaladditional memory 18, and a secure memory 20, a personalization keystorage and decoding unit 22, and a number of configurable features 24.In this example, configurable features 24 include a configurable memoryaddress scrambler 24A, pinout tables 24B, interrupt vector table(s) 24C,and an internal test unit 24D, for example. Secure memory 20 may store adevice personalization key 30 that includes a plurality of sub-keys 32.Device personalization key 30 may include any suitable number ofsub-keys 32.

Processor 12 may, for example, be a processor core MCU which has accessto data memory 14 through the configurable memory address scrambler 24A,which performs address scrambling according to one or more methodsdefined by one of the sub-keys 32 of the device personalization key 30stored in secure memory 20. In some embodiments, additional data memory16, which typically is not accessible in a general purpose device, canbe activated by one of the sub-keys 32. In addition to the memoryaddress scrambler 24A, various other configurable features 24 of themicrocontroller 10 may be defined by the personalization key 30, such asthe configuration of a specific pinout (defined by pinout tables 24B),address(es) of interrupt vector tables) 24C, internal test entrysequences defined by internal test unit 24D, and other configurablefunctions as explained above.

Data memory 14, program memory 16, additional memory 18, and securememory 20 may be formed as discrete memory structures, or any two ormore (or all) of such memories may comprise specified areas of anintegrated memory structure. For example, secure memory 20 may be aphysically distinct memory structure from data memory 14, additionalmemory 16, and/or program memory 16, or may comprise an assigned area ofan integrated memory device.

Personalization key storage and decoding unit 22 may provide aninterface for, or otherwise facilitate, writing key 30 into securememory 20 (i.e., programming the key into secure memory 20), and mayalso be configured to decode key 30. In some embodiments, the decodingmay be performed by simple logic, such as comparators, as multiplesub-key values may be assigned to the same function configuration, e.g.,as discussed below regarding FIG. 3.

Thus, customer-specific devices 10 can be produced by merely programmingthe personalization key 30 with a unique code. Such devices canotherwise be produced as a single version. According to someembodiments, at end of a manufacturing line, such device may be providedwith different device numbers on the housing of the device or optionallywith no markings at all. However, they could also simply comprise thesame markings as a general purpose device. Thus, it would be unknown toa third person that the device is actually differently configured than ageneral purpose device.

FIGS. 2-4 illustrate various aspects of the device personalization key30, according to certain embodiments.

FIG. 2 shows an example of an n-bit programmable key 30 that can beprogrammed into device 10, for example into an associated register ofsecure memory 20. Secure memory 20 may be provided which provides fornon-volatile storage of the key which cannot be read by a user. In someembodiments, memory 20 is configured such that it can be written to onlyonce and is inaccessible a user will have no access to this memory onceit is programmed.

As shown, the personalization key 30 may include several “sub-keys” 32.In this example, key 30 includes six sub-keys 32, labeled A-F. However,key 30 may include any other suitable number of sub-keys 32. Further,each sub-key 32 of a key 30 may have any suitable length (e.g., numberof bits). Further, the sub-keys 32 of a particular key 30 may have thesame length or different lengths. Each sub-key 32 may be assigned to aparticular configurable features or aspect of the device 10. In theexample shown in FIG. 2, sub-keys A-F are assigned to the following sixconfigurable aspects of the device 10: (A) the start location of an SRAM(static random-access memory) area, e.g., within data memory 14; (B) theaddress of an interrupt vector table 24C, e.g., within program memory16; (C) the availability or enabled state of a peripheral set associatedwith the device 10; (D) an internal test entry sequence (e.g., asdefined by internal test unit 24D); (E) an SFR (special functionregister) memory map (e.g., utilized by memory address scrambler 24A;and (F) a pinout configuration (e.g., as defined by pinout tables 24B).

Each of such configurable features may have multiple different possibleconfigurations. Each sub-key A-F has a n-bit value that defines theselection of a particular one of the multiple possible configurationsfor the corresponding configurable feature. For example, the value ofsub-key D may define a particular test entry sequence selected fromthree different possible test entry sequences. As another example, thevalue of sub-key F may define a particular pinout configuration selectedfrom six possible pinout configurations.

Thus, various configurations or functionalities of the device 10 can bedefined in various ways using the multiple sub-keys 32. For example, aconfigurable programmable pin assignment (defined by sub-key F) mayallow to assign external pins of a semiconductor device 10, for examplea microcontroller, to be connected to a specific peripheral device.Without the correct code, this function may not be activated renderingthe device inoperable when using copied firmware.

Each configurable feature may have any suitable number of possibleselectable configurations. Further, each sub-key may have any suitablelength (in bits), thus allowing for any number of possible values. Inone example embodiment, a sub-key 32 may be 4 bits long, thus defining16 possible values.

In some embodiments, each sub-key may have more possible values thanpossible selectable configurations for the associated configurablefeature, thus allowing the assignment of multiple sub-key values to eachselectable configuration for the feature, which may provide additionalprotection against copying or reverse engineering the device.

For example, FIG. 3 highlights sub-key “D” corresponding to theconfigurable test entry sequence. The test entry sequence may have fourselectable sequences, Sequence #1, Sequence #2, Sequence #3, andSequence #4. Sub-key D may have a 4-bit value, thus defining 16 possiblesub-key values. Thus, as shown, four different 4-bit sub-key values aremapped to each of the four sequences.

This mapping arrangement may help prevent reverse-engineering of key 30from knowledge of feature sets/configurations. Moreover, figuring outthe configured test entry sequence (e.g., Sequence #3) may only indicateof one possible sub-key value (out of the four sub-key values assignedto Sequence #3), which may not be the correct value key (e.g., theSequence #3 sub-value “1000” may be identified, while the actualSequence #3 sub-key value in the key 30 is “1010”). This incorrectidentification may prevent a copier from accessing a function that isenabled only by the full, correct key 30, as explained below withreference to FIG. 4

Internally, the sub-key decoding provided by decoding unit 22 merelyneeds simple logic, such as comparators, as multiple sub-key values maybe assigned to the same function configuration. If each sub-key valuegenerates a unique function configuration, then a simple decoder can beused. A general purpose device may comprise this additionalpersonalization feature and a predefined key 30 may be stored. Inaddition, device 10 may include logic that prevents accidentalprogramming of the key 30. Thus, device 10 may include a specificprogramming sequence to allow a one-time-only programming of the key 30to prevent accidental overwriting, e.g., for users that do not need thisfunctionality.

Moreover, in some embodiments, the functionality may not be documentedfor general purpose devices. Only customers that require thisfunctionality would be provided with the associated personalizationfunction. For example, in embodiments where the manufacturer programsthe key 30 individually for a customer, a dedicated data sheet may beprovided for this customer that explains the specific functions as setby the specific key 30. However, a more complex data sheet could beprovided that explains the various setting that respective keys wouldgenerate.

As discussed above, in some embodiments, the full device personalizationkey 30 can be used to compute an additional value, or “signature,” toenable, configure, or personalize a particular feature or function ofdevice 10. FIG. 4 illustrates an example of this aspect. As shown, analgorithm or function 40 can be applied to the full personalization key30 (including all sub-keys) to generate a key signature value 42 thatmay be used to enable, configure, or personalize a particular feature ofthe device 10. For example, the key signature value 42 may define aselection of a configurable feature, in a similar manner as each sub-key24. Alternatively, the key signature value 42 itself may be used toprovide a function. For instance, the key signature value 42 itself maybe used as an encryption key, e.g., for internal device communicationsor for communications with external devices.

The algorithm or function 40 may include any algorithm or function totransform or convert the key 30 into a key signature value 42. Forexample, a cyclic redundancy check (CRC), or a one-way function such asa hash function, could be used to generate a code number (key signaturevalue 42) from a long device personalization key 30.

Thus, in order to enable, configure, or personalize a particular featureor function of device 10, the full exact key 30, including all sub-keys24, must be known. Thus, for a particular device, even if one were todetermine a suitable sub-key to correctly configure each feature of thedevice, the additional feature enabled or configured by the full devicepersonalization key 30 (e.g., by the key signature value 42 generatedfrom the full key 30) cannot be provided without exact knowledge of thefull device personalization key 30.

In other embodiments, the key signature value 42 may be generated basedon multiple sub-keys 24 of a key, but less than the entire key 30. Forexample, the key signature value 42 may be generated based on a subsetof the sub-key values, or based on a portion of every sub-key value.

Thus, according to the above, in some embodiments, in order to clone aproduct, one must possess the original program code (or image), theknowledge of which general purpose part is being used, and the exact andfull device personalization key.

For decoding the personalization key 30, any encryption key proceduremay be used, according to various embodiments. The disclosed methodallows the addition of device personalization to any semiconductordevice that comprises a programming interface, without the need to applya different mask set during manufacturing. Separate personalization keystorage ensures that if a customer's program code is copied, and someoneknows which manufacturer device is being used, they can not clone thedevice without significant effort. In some embodiments, a base approachfor the manufacturer could be to program a personalization key, and thengive out a custom datasheet to match the device as stated above. Anextended approach in other embodiments is to allow the customer toprogram their own personalization key, which allows the customer to havetotal control over their own supply chain. The customer may inform themanufacturer of a set of desired configuration for various devicefeatures (e.g., a desired set of features, desired memory map, desiredpinout, etc.) and the manufacturer may then provide a list of sub-keyvalue corresponding to the selected configuration for each feature (aseach configuration may have multiple assigned sub-key values, asdiscussed above regarding FIG. 3). The customer may then assembles apersonalization key from any of these sub-key values, and program theresulting key into their device, thereby giving the customer apersonalization key that is unknown to the manufacturer.

Although the disclosed embodiments are described in detail in thepresent disclosure, it should be understood that various changes,substitutions and alterations can be made to the embodiments withoutdeparting from their spirit and scope.

1. A semiconductor device, comprising: a secure memory configured tostore a programmable key; an interface for programming the programmablekey in the secure memory; and a plurality of configurable features ofthe semiconductor device that are associated with the programmable key,each configurable feature having a set of multiple selectableconfigurations; wherein a value of the key defines a selection of one ofthe multiple configurations for each of the configurable features. 2.The semiconductor device according to claim 1, wherein the key comprisesa plurality of sub-keys, wherein each sub-key is associated with one ofthe plurality of configurable features, and wherein a value of eachsub-key defines a selection of one of the multiple configurations forthe configurable feature associated with that sub-key.
 3. Thesemiconductor device according to claim 1, wherein the plurality ofconfigurable features comprises at last one of a pinout configuration, amemory mapping of a memory of the semiconductor device, a test entrysequence, a peripheral set availability, an interrupt vector tablelocation, and an SRAM start location.
 4. The semiconductor deviceaccording to claim 1, wherein the full programmable key enables anadditional functionality of the semiconductor device.
 5. Thesemiconductor device according to claim 4, wherein the additionalfunctionality of the semiconductor device is enabled by a valueresulting from an application of a logical algorithm to the fullprogrammable key.
 6. The semiconductor device according to claim 5,wherein the logical algorithm comprises a cyclic redundancy check or ahash function.
 7. The semiconductor device according to claim 4, whereinthe additional functionality full enabled by the full programmable keyis a memory address or code scrambling function.
 8. The semiconductordevice according to claim 1, comprising electronics that allow theprogrammable key to be programmed only once.
 9. The semiconductor deviceaccording to claim 8, comprising an access device for writing said keyand configured to prevent accidental overwriting of the key.
 10. Thesemiconductor device according to claim 1, with the programmable keyprogrammed and stored in the secure memory.
 11. A method for configuringa semiconductor device having an accessible memory, a secure memory, aconfiguration interface, and a plurality of configurable features, eachconfigurable feature having a set of multiple selectable configurations,the method comprising: programming a key into the secure memory usingthe configuration interface provided on the semiconductor device;wherein a value of the key defines a selection of one of the multipleconfigurations for each of the configurable features.
 12. The methodaccording to claim 11, wherein the key comprises a plurality ofsub-keys, wherein each sub-key is associated with one of the pluralityof configurable features, and wherein a value of each sub-key defines aselection of one of the multiple configurations for the configurablefeature associated with that sub-key.
 13. The method according to claim11, wherein the plurality of configurable features comprises at last oneof a pinout configuration, a memory mapping of a memory of thesemiconductor device, a test entry sequence, a peripheral setavailability, an interrupt vector table location, and an SRAM startlocation.
 14. The method according to claim 11, wherein the full keyenables an additional functionality of the semiconductor device.
 15. Themethod according to claim 14, comprising applying a logical algorithm tothe full key to generate a value that enables the additionalfunctionality of the semiconductor device.
 16. The method according toclaim 15, wherein the logical algorithm comprises a cyclic redundancycheck or a hash function.
 17. The method according to claim 14, whereinthe additional functionality full enabled by the full key is a memoryaddress or code scrambling function.
 18. The method according to claim11, wherein the device prevents the key from being programmed more thanonce.
 19. The method according to claim 11, wherein the device preventsthe key from being programmed more than once by using an access devicefor writing the key and preventing an accidental overwriting of the key.